Syntax error in module. Incorrect syntax near '(' expecting a closing parenthesis ')' but found an opening parenthesis '(' at line 6 column 30, please check the filter specification within the from clause [@Name('Module_xxxxxxxxxxx_Alert') @Description('') @RSAAlert(oneInSeconds=0) SELECT * FROM Event( /* Statement: NEW */ (index.toLowerCase() LIKE '%toto%')

)]

Index is listed as a string in the meta key definitions.

The main reason for this behavior is that index is a keyword in EPL, so it cannot be used as a meta parsed in lowercase.

Resolution

A workaround is available for RSA NetWitness Platform version 11.3.x onwards, If a customer wants to use index meta with lowercase functionality they can declare 'index' meta under 'lowercase' field in the Correlation Server Explore view and use 'index_lower' in the ESA rule which will have a lowercase value of index meta. It is always recommended to identify the meta that needs lowercase functionality and add it under lowercase field to improve the performance.

Steps to add index meta to lowercase -

Navigate to Admin-> Services-> ESA Correlation ->Explore

Under Explore go to correlation->stream and add meta (in this case index) under lowercase field